id: IOC Alert version: -1 name: IOC Alert description: "IOCs provide the ability to alert on known malicious objects on endpoints across the organization. \n\n**Analysis Actions:**\nThe playbook will use several enrichment sources to determine the IOC verdict. Additionally, will use the Analytics module to run a prevalence check for the IOC.\n\n**Response Actions:**\nThe playbook's first response action is a containment plan that is based on the playbook input. In that phase, the playbook will execute endpoint isolation\n\n**Investigative Actions:**\nWhen the playbook executes, it checks for additional abnormal activity using the Endpoint Investigation Plan playbook that can indicate the endpoint might be compromised.\n\n**Remediation Actions:**\nIn case results are found within the investigation phase, the playbook will execute remediation actions that include containment and eradication.\n\nThis phase will execute the following containment actions:\n\n* File quarantine\n* Endpoint isolation\n\nAnd the following eradication actions:\n\n* Manual process termination\n* Manual file deletion." starttaskid: "0" tasks: "0": id: "0" taskid: 6e568fda-d217-4f3c-8a2e-b88b0d7ce2cf type: start task: id: 6e568fda-d217-4f3c-8a2e-b88b0d7ce2cf version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "47" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 410, "y": -110 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "10": id: "10" taskid: e0f81dd8-c1b5-4641-80c2-d06d57e246e9 type: condition task: id: e0f81dd8-c1b5-4641-80c2-d06d57e246e9 version: -1 name: Found suspicious IOC? description: Checks if any suspicious IOCs were found to continue with the alert investigation. type: condition iscommand: false brand: "" nexttasks: '#default#': - "12" "yes": - "76" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: IPVerdict iscontext: true right: value: simple: Suspicious - operator: isEqualString left: value: complex: root: FileVerdict iscontext: true right: value: simple: Suspicious - operator: isEqualString left: value: complex: root: DomainVerdict iscontext: true right: value: simple: Suspicious - operator: containsString left: value: complex: root: Core.AnalyticsPrevalence.Ip accessor: value transformers: - operator: append args: item: value: simple: Core.AnalyticsPrevalence.Hash.value iscontext: true - operator: append args: item: value: simple: Core.AnalyticsPrevalence.Domain.value iscontext: true - operator: append args: item: value: simple: Core.AnalyticsPrevalence.Process.value iscontext: true - operator: append args: item: value: simple: Core.AnalyticsPrevalence.Registry.value iscontext: true - operator: append args: item: value: simple: Core.AnalyticsPrevalence.Cmd.value iscontext: true iscontext: true right: value: simple: "True" ignorecase: true continueonerrortype: "" view: |- { "position": { "x": 410, "y": 530 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "12": id: "12" taskid: 247d2a4d-60bd-4ba6-8ced-d54cb5dfd5d0 type: title task: id: 247d2a4d-60bd-4ba6-8ced-d54cb5dfd5d0 version: -1 name: Handle False Positive type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "69" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -230, "y": 745 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "25": id: "25" taskid: 8984e9bb-8b45-430a-8397-509e2865c466 type: title task: id: 8984e9bb-8b45-430a-8397-509e2865c466 version: -1 name: Investigation type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "68" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 410, "y": 1210 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "37": id: "37" taskid: b1098495-80b3-4450-80fe-79f14e84a9f4 type: title task: id: b1098495-80b3-4450-80fe-79f14e84a9f4 version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 410, "y": 3380 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "47": id: "47" taskid: c4e0656d-a1b2-4166-850e-4faa6e06a6c9 type: title task: id: c4e0656d-a1b2-4166-850e-4faa6e06a6c9 version: -1 name: 'Analysis ' type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "82" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 410, "y": 40 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "54": id: "54" taskid: eedbc660-cd5d-4fa8-8b6b-c6ad6acba120 type: condition task: id: eedbc660-cd5d-4fa8-8b6b-c6ad6acba120 version: -1 name: Found relevant information? description: Checks if relevant information was found. type: condition iscommand: false brand: "" nexttasks: '#default#': - "60" "yes": - "83" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: foundIncidents iscontext: true continueonerrortype: "" view: |- { "position": { "x": 410, "y": 1540 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "60": id: "60" taskid: 6428ba34-883b-45cf-8c12-f8411f434de7 type: title task: id: 6428ba34-883b-45cf-8c12-f8411f434de7 version: -1 name: Recovery type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "73" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 410, "y": 2530 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "66": id: "66" taskid: d28beff8-6a1a-47ab-8fe9-f894e9a17cfc type: playbook task: id: d28beff8-6a1a-47ab-8fe9-f894e9a17cfc version: -1 name: Enrichment for Verdict description: This playbook checks prior alert closing reasons and performs enrichment and prevalence checks on different IOC types. It then returns the information needed to establish the alert's verdict. playbookName: Enrichment for Verdict type: playbook iscommand: false brand: "" nexttasks: '#none#': - "10" scriptarguments: CloseReason: simple: Resolved - False Positive,Resolved - Duplicate Incident,Resolved - Known Issue Domain: complex: root: ExtractedIndicators accessor: Domain FileSHA256: complex: root: ExtractedIndicators accessor: File IP: complex: root: ExtractedIndicators accessor: IP URL: complex: root: ExtractedIndicators accessor: URL query: simple: sourceBrand:"${alert.sourceBrand}" and name:"${alert.name}" threshold: simple: "5" separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 410, "y": 340 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "67": id: "67" taskid: 42c60c2c-36bc-43db-8a99-2120db91b67c type: playbook task: id: 42c60c2c-36bc-43db-8a99-2120db91b67c version: -1 name: Containment Plan description: "This playbook handles all the containment actions available with Cortex XSIAM, including: \n* Isolate endpoint\n* Disable account\n* Quarantine file\n* Block indicators\n* Clear user session (currently, the playbook supports only Okta)\n\nNote: The playbook inputs enable manipulating the execution flow. Read the input descriptions for details." playbookName: Containment Plan type: playbook iscommand: false brand: "" nexttasks: '#none#': - "25" scriptarguments: AutoContainment: complex: root: inputs.BlockIndicatorsAutomatically transformers: - operator: SetIfEmpty args: applyIfEmpty: value: simple: "false" defaultValue: value: simple: "false" BlockIndicators: simple: "False" ClearUserSessions: simple: "False" EndpointID: complex: root: alert accessor: agentid FileContainment: simple: "False" FileRemediation: simple: Quarantine HostContainment: simple: "True" UserContainment: simple: "False" separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 660, "y": 1040 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "68": id: "68" taskid: 323c4f4e-36a1-4cc9-8c31-d54582ed410e type: playbook task: id: 323c4f4e-36a1-4cc9-8c31-d54582ed410e version: -1 name: Endpoint Investigation Plan description: "This playbook handles all the endpoint investigation actions available with Cortex XSIAM, including the following tasks:\n* Pre-defined MITRE Tactics\n* Host fields (Host ID)\n* Attacker fields (Attacker IP, External host)\n* MITRE techniques\n* File hash (currently, the playbook supports only SHA256) \n\nNote: The playbook inputs enable manipulating the execution flow. Read the input descriptions for details." playbookName: Endpoint Investigation Plan type: playbook iscommand: false brand: "" nexttasks: '#none#': - "54" scriptarguments: HuntCnCTechniques: simple: "True" HuntCollectionTechniques: simple: "True" HuntDefenseEvasionTechniques: simple: "True" HuntDiscoveryTechniques: simple: "True" HuntExecutionTechniques: simple: "True" HuntImpactTechniques: simple: "True" HuntInitialAccessTechniques: simple: "True" HuntLateralMovementTechniques: simple: "True" HuntPersistenceTechniques: simple: "True" HuntPrivilegeEscalationTechniques: simple: "True" HuntReconnaissanceTechniques: simple: "True" agentID: complex: root: alert accessor: agentid separatecontext: false continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 410, "y": 1365 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "69": id: "69" taskid: 5b77fe0b-f78b-4604-868e-a574e916afd1 type: playbook task: id: 5b77fe0b-f78b-4604-868e-a574e916afd1 version: -1 name: Handle False Positive Alerts description: | This playbook handles false positive alerts. It creates an alert exclusion or alert exception, or adds a file to an allow list based on the alert fields and playbook inputs. playbookName: Handle False Positive Alerts type: playbook iscommand: false brand: "" nexttasks: '#none#': - "37" scriptarguments: FileSHA256: complex: root: alert accessor: initiatorsha256 IOC: complex: root: alert accessor: name transformers: - operator: RegexGroups args: flags: {} groups: value: simple: "0" keys: {} regex: value: simple: IOC\s+\((.*)\) ShouldCloseAutomatically: complex: root: inputs.ShouldCloseAutomatically ShouldHandleFPautomatically: complex: root: inputs.ShouldHandleFPautomatically alertName: complex: root: alert accessor: name sourceIP: complex: root: alert accessor: hostip username: complex: root: alert accessor: username separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": -230, "y": 880 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "72": id: "72" taskid: b7c41b05-77b0-435c-885e-015688350d6c type: regular task: id: b7c41b05-77b0-435c-885e-015688350d6c version: -1 name: close alert description: Closes the alert in Cortex XSIAM. script: Builtin|||closeInvestigation type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "37" scriptarguments: closeReason: simple: Resolved - Threat Handled separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 750, "y": 3200 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "73": id: "73" taskid: af811990-e3b5-4329-804d-b3c43a770f55 type: condition task: id: af811990-e3b5-4329-804d-b3c43a770f55 version: -1 name: Should restore affected endpoint? description: Checks if it should release the affected endpoint from isolation. type: condition iscommand: false brand: "" nexttasks: '#default#': - "74" "yes": - "75" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.AutoRestoreEndpoint iscontext: true right: value: simple: "True" ignorecase: true continueonerrortype: "" view: |- { "position": { "x": 410, "y": 2665 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "74": id: "74" taskid: 3529adf2-dc0d-40b4-8dae-2cf84c2d7641 type: condition task: id: 3529adf2-dc0d-40b4-8dae-2cf84c2d7641 version: -1 name: Should close alert automatically? description: Whether to close the alert automatically or manually. type: condition iscommand: false brand: "" nexttasks: '#default#': - "37" "yes": - "72" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.ShouldCloseAutomatically iscontext: true right: value: simple: "True" ignorecase: true continueonerrortype: "" view: |- { "position": { "x": 410, "y": 3020 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "75": id: "75" taskid: d36e9607-9c96-4688-8d3f-65bb37739224 type: playbook task: id: d36e9607-9c96-4688-8d3f-65bb37739224 version: -1 name: Recovery Plan description: |- This playbook handles all the recovery actions available with Cortex XSIAM, including the following tasks: * Unisolate endpoint * Restore quarantined file Note: The playbook inputs enable manipulating the execution flow. Read the input descriptions for details. playbookName: Recovery Plan type: playbook iscommand: false brand: "" nexttasks: '#none#': - "74" scriptarguments: endpointID: complex: root: alert accessor: agentid releaseFile: simple: "false" unIsolateEndpoint: simple: "true" separatecontext: true continueonerrortype: "" view: |- { "position": { "x": 760, "y": 2840 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "76": id: "76" taskid: b80d75a1-dc20-4414-88cf-3884b5831def type: title task: id: b80d75a1-dc20-4414-88cf-3884b5831def version: -1 name: Pre-Investigation Containment type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "77" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 410, "y": 745 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "77": id: "77" taskid: c2cbe10d-8222-4923-89bf-affca982e631 type: condition task: id: c2cbe10d-8222-4923-89bf-affca982e631 version: -1 name: Should run pre-investigation containment? description: Checks whether to isolate the host after the investigation phase. type: condition iscommand: false brand: "" nexttasks: '#default#': - "25" "yes": - "67" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.PreHostContainment transformers: - operator: toLowerCase iscontext: true right: value: simple: "true" ignorecase: true continueonerrortype: "" view: |- { "position": { "x": 410, "y": 870 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "79": id: "79" taskid: a6324b2e-b539-433e-839c-7bdd2bb90f68 type: title task: id: a6324b2e-b539-433e-839c-7bdd2bb90f68 version: -1 name: Remediation type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "80" - "81" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 870, "y": 2220 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "80": id: "80" taskid: 9ea917dd-abb0-425f-81b1-0496a82a1d86 type: playbook task: id: 9ea917dd-abb0-425f-81b1-0496a82a1d86 version: -1 name: Containment Plan description: "This playbook handles all the containment actions available with Cortex XSIAM, including: \n* Isolate endpoint\n* Disable account\n* Quarantine file\n* Block indicators\n* Clear user session (currently, the playbook supports only Okta)\n\nNote: The playbook inputs enable manipulating the execution flow. Read the input descriptions for details." playbookName: Containment Plan type: playbook iscommand: false brand: "" nexttasks: '#none#': - "60" scriptarguments: AutoContainment: complex: root: inputs.AutoContainment transformers: - operator: SetIfEmpty args: applyIfEmpty: {} defaultValue: value: simple: "false" BlockIndicators: simple: "False" ClearUserSessions: simple: "True" EndpointID: complex: root: alert accessor: agentid FileContainment: simple: "True" FileHash: complex: root: foundIncidents.CustomFields filters: - - operator: isNotEqualString left: value: simple: foundIncidents.CustomFields.initiatorpath iscontext: true right: value: simple: c:\windows\explorer.exe ignorecase: true accessor: initiatorsha256 FilePath: complex: root: foundIncidents.CustomFields.initiatorpath filters: - - operator: isNotEqualString left: value: simple: foundIncidents.CustomFields.initiatorpath iscontext: true right: value: simple: c:\windows\explorer.exe ignorecase: true FileRemediation: complex: root: inputs.FileRemediation HostContainment: simple: "True" UserContainment: simple: "True" separatecontext: false continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 1080, "y": 2360 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "81": id: "81" taskid: 527b0732-8b4e-45eb-8c22-a61057190ef3 type: playbook task: id: 527b0732-8b4e-45eb-8c22-a61057190ef3 version: -1 name: Eradication Plan description: "This playbook handles all the eradication actions available with Cortex XSIAM, including the following tasks:\n* Reset user password\n* Delete file\n* Kill process (currently, the playbook supports terminating a process by name) \n\nNote: The playbook inputs enable manipulating the execution flow. Read the input descriptions for details." playbookName: Eradication Plan type: playbook iscommand: false brand: "" nexttasks: '#none#': - "60" scriptarguments: AutoEradicate: complex: root: inputs.AutoEradication EndpointID: complex: root: alert accessor: agentid FilePath: complex: root: foundIncidents.CustomFields accessor: initiatorpath FileRemediation: complex: root: inputs.FileRemediation separatecontext: false continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 660, "y": 2360 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "82": id: "82" taskid: 03afb60a-4f65-4e42-82ff-3134d5b84042 type: regular task: id: 03afb60a-4f65-4e42-82ff-3134d5b84042 version: -1 name: Extract IOC description: commands.local.cmd.extract.indicators script: Builtin|||extractIndicators type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "66" scriptarguments: text: complex: root: alert accessor: details separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 410, "y": 170 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "83": id: "83" taskid: 37a6525e-26a7-4c1f-8531-17fe493b2642 type: regular task: id: 37a6525e-26a7-4c1f-8531-17fe493b2642 version: -1 name: Set Incident Severity to High description: commands.local.cmd.set.parent.incident.field script: Builtin|||setParentIncidentFields type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "84" scriptarguments: manual_severity: simple: high separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 870, "y": 1710 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 2 isoversize: false isautoswitchedtoquietmode: false "84": id: "84" taskid: 3774b478-5564-4675-8074-739dd558664c type: condition task: id: 3774b478-5564-4675-8074-739dd558664c version: -1 name: Should open a ticket automatically in a ticketing system? description: Checks whether to open a ticket automatically in a ticketing system. type: condition iscommand: false brand: "" nexttasks: '#default#': - "79" "yes": - "85" separatecontext: false conditions: - label: "yes" condition: - - operator: isEqualString left: value: complex: root: inputs.ShouldOpenTicket iscontext: true right: value: simple: "True" ignorecase: true continueonerrortype: "" view: |- { "position": { "x": 870, "y": 1880 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "85": id: "85" taskid: f77aa4eb-f400-4a50-829f-4ce59cad479f type: playbook task: id: f77aa4eb-f400-4a50-829f-4ce59cad479f version: -1 name: Ticket Management - Generic description: "`Ticket Management - Generic` allows you to open new tickets or update comments to the existing ticket in the following ticketing systems:\n-ServiceNow \n-Zendesk \nusing the following sub-playbooks:\n-`ServiceNow - Ticket Management`\n-`Zendesk - Ticket Management`\n" playbookName: Ticket Management - Generic type: playbook iscommand: false brand: "" nexttasks: '#none#': - "79" scriptarguments: CommentToAdd: complex: root: inputs.CommentToAdd ZendeskAssigne: complex: root: inputs.ZendeskAssigne ZendeskCollaborators: complex: root: inputs.ZendeskCollaborators ZendeskPriority: complex: root: inputs.ZendeskPriority ZendeskRequester: complex: root: inputs.ZendeskRequester ZendeskStatus: complex: root: inputs.ZendeskStatus ZendeskSubject: complex: root: inputs.ZendeskSubject ZendeskTags: complex: root: inputs.ZendeskTags ZendeskType: complex: root: inputs.ZendeskType addCommentPerEndpoint: complex: root: inputs.addCommentPerEndpoint description: complex: root: inputs.description serviceNowAssignmentGroup: complex: root: inputs.serviceNowAssignmentGroup serviceNowCategory: complex: root: inputs.serviceNowCategory serviceNowImpact: complex: root: inputs.serviceNowImpact serviceNowSeverity: complex: root: inputs.serviceNowSeverity serviceNowShortDescription: complex: root: inputs.serviceNowShortDescription serviceNowTicketType: complex: root: inputs.serviceNowTicketType serviceNowUrgency: complex: root: inputs.serviceNowUrgency separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 1160, "y": 2050 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": { "10_12_#default#": 0.52, "54_83_yes": 0.41, "73_74_#default#": 0.44, "73_75_yes": 0.41, "74_37_#default#": 0.54, "74_72_yes": 0.48, "77_25_#default#": 0.47 }, "paper": { "dimensions": { "height": 3555, "width": 1770, "x": -230, "y": -110 } } } inputs: - key: BlockIndicatorsAutomatically value: simple: "False" required: false description: Whether to block suspicious/malicious indicators automatically. Specify True/False. playbookInputQuery: - key: ShouldCloseAutomatically value: simple: "True" required: false description: Whether to close the alert automatically if it's established verdict is False Positive. Specify True/False. playbookInputQuery: - key: PreHostContainment value: simple: "False" required: false description: Whether to isolate the host before the investigation phase in case an IOC was found to be suspicious. Specify True/False. playbookInputQuery: - key: ShouldHandleFPautomatically value: {} required: false description: Whether to automatically handle false positive alerts. Specify true/false. playbookInputQuery: - key: AutoRestoreEndpoint value: {} required: false description: Whether to execute the Recovery playbook. Specify True/False. playbookInputQuery: - key: AutoContainment value: {} required: false description: |- Setting this input will impact both Containment Plan sub-playbooks. Without setting this input, the default values are True for the first occurrence and False for the second. Whether to execute automatically or manually the containment plan tasks: * Isolate endpoint * Block indicators * Quarantine file * Disable user Specify True/False. playbookInputQuery: - key: FileRemediation value: simple: Quarantine required: false description: Should be either 'Quarantine' or 'Delete'. playbookInputQuery: - key: AutoEradication value: simple: "False" required: false description: |- Whether to execute automatically or manually the eradication plan tasks: * Terminate process * Delete file * Reset the user's password Specify True/False. playbookInputQuery: - key: ShouldOpenTicket value: simple: "False" required: false description: Whether to open a ticket automatically in a ticketing system. (True/False). playbookInputQuery: - key: serviceNowShortDescription value: simple: XSIAM Incident ID - ${parentIncidentFields.incident_id} required: false description: A short description of the ticket. playbookInputQuery: - key: serviceNowImpact value: {} required: false description: The impact for the new ticket. Leave empty for ServiceNow default impact. playbookInputQuery: - key: serviceNowUrgency value: {} required: false description: The urgency of the new ticket. Leave empty for ServiceNow default urgency. playbookInputQuery: - key: serviceNowSeverity value: {} required: false description: The severity of the new ticket. Leave empty for ServiceNow default severity. playbookInputQuery: - key: serviceNowTicketType value: {} required: false description: The ServiceNow ticket type. Options are "incident", "problem", "change_request", "sc_request", "sc_task", or "sc_req_item". Default is "incident". playbookInputQuery: - key: serviceNowCategory value: {} required: false description: The category of the ServiceNow ticket. playbookInputQuery: - key: serviceNowAssignmentGroup value: {} required: false description: The group to which to assign the new ticket. playbookInputQuery: - key: ZendeskPriority value: {} required: false description: The urgency with which the ticket should be addressed. Allowed values are "urgent", "high", "normal", or "low". playbookInputQuery: - key: ZendeskRequester value: {} required: false description: The user who requested this ticket. playbookInputQuery: - key: ZendeskStatus value: {} required: false description: The state of the ticket. Allowed values are "new", "open", "pending", "hold", "solved", or "closed". playbookInputQuery: - key: ZendeskSubject value: simple: XSIAM Incident ID - ${parentIncidentFields.incident_id} required: false description: The value of the subject field for this ticket. playbookInputQuery: - key: ZendeskTags value: {} required: false description: The array of tags applied to this ticket. playbookInputQuery: - key: ZendeskType value: {} required: false description: The type of this ticket. Allowed values are "problem", "incident", "question", or "task". playbookInputQuery: - key: ZendeskAssigne value: {} required: false description: The agent currently assigned to the ticket. playbookInputQuery: - key: ZendeskCollaborators value: {} required: false description: The users currently CC'ed on the ticket. playbookInputQuery: - key: description value: simple: ${parentIncidentFields.description}. ${parentIncidentFields.xdr_url} required: false description: The ticket description. playbookInputQuery: - key: addCommentPerEndpoint value: simple: "True" required: false description: 'Whether to append a new comment to the ticket for each endpoint in the incident. Possible values: True/False.' playbookInputQuery: - key: CommentToAdd value: simple: '${alert.name}. Alert ID: ${alert.id}' required: false description: Comment for the ticket. playbookInputQuery: inputSections: - inputs: - ShouldCloseAutomatically - ShouldHandleFPautomatically name: Alert Management description: Alert management settings and data, including escalation processes, and user engagements. - inputs: - PreHostContainment - AutoEradication - AutoContainment - BlockIndicatorsAutomatically - FileRemediation - AutoRestoreEndpoint name: Remediation description: Remediation settings and data, including containment, eradication, and recovery. - inputs: - ShouldOpenTicket - serviceNowShortDescription - serviceNowImpact - serviceNowUrgency - serviceNowSeverity - serviceNowTicketType - serviceNowCategory - serviceNowAssignmentGroup - ZendeskPriority - ZendeskRequester - ZendeskStatus - ZendeskSubject - ZendeskTags - ZendeskType - ZendeskAssigne - ZendeskCollaborators - description - addCommentPerEndpoint - CommentToAdd name: Ticket Management description: Ticket management settings and data. outputSections: - outputs: [] name: General (Outputs group) description: Generic group for outputs outputs: [] tests: - Test Playbook - IOC Alert marketplaces: - marketplacev2 - platform fromversion: 6.6.0 supportedModules: - agentix - cloud - cloud_posture - cloud_runtime_security - edr - xsiam